I am game programmer with limited web experience that was tasked to figure out how to make our game interact with Facebook. We are building a Unity Windows standalone app (maybe MacIntosh later), and our publisher wants us to enable the player to post in-game selfies to their wall in Facebook. That is all we need to do, we do not need to touch their friends list or anything else like that at all.
I have been digging to find out exactly how to do this, and the available advice online or prebuilt Facebook API Asset Store packages rely on the mobile API which we can't use. So, looks like we have to roll our own for the time being. I have been reading the developers.facebook.com section on Login Flow and it says that we should
- Request a login dialog for the player with our App ID
- Take the Access Token out of the response
- Then combine it with our App Secret to make API calls
Facebook also says that for security reasons, we should never embed the App Secret into the source of our client exe, so that hackers can't disassemble the exe and pull our secret out for them to use for their own purposes. That makes sense. Instead, they recommend that the App Secret remain on a server and that our client delegate API calls to that server. Seems like a smart way to do it.
However, we don't have a server, our publisher won't pay us to make a server or maintain the hardware, and even if they did, we don't have time to make one. So, what is the best practice for a client-only native Unity standalone app?